Article 3. System Requirements
11VAC20-20-190. Distributed pull-tab system.
A distributed pull-tab system shall be dedicated primarily to electronic accounting, reporting, and the presentation, randomization, and transmission of electronic gaming to the electronic gaming devices. It shall also be capable of generating the data necessary to provide the reports required within this article or otherwise specified by the department.
Statutory Authority
§ 18.2-340.15 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 39, Issue 14, eff. March 29, 2023.
11VAC20-20-200. Dispensing of electronic pull-tabs.
A distributed pull-tab system shall dispense, upon request, an electronic pull-tab. All games must be played without replacement, drawing from a single finite game set.
Statutory Authority
§ 18.2-340.15 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 39, Issue 14, eff. March 29, 2023.
11VAC20-20-210. Game set requirements.
Each game set shall meet the following minimum requirements:
1. Each game set shall be made up of a finite number of electronic pull-tabs;
2. The game set shall consist of a maximum of 25,000 electronic pull-tabs;
3. All electronic pull-tabs in a particular game set shall be of the same purchase price;
4. The maximum win amount awarded per any one electronic pull-tab shall not exceed the value set forth for pull-tabs by § 18.2-340.33 of the Code of Virginia;
5. Each game set shall be assigned a unique serial number;
6. After randomization, game sets may be broken into subsets of equal size. If game subsets are used, they shall each be assigned a unique serial number and be traceable to a parent game set; and
7. Game sets shall not be commingled.
Statutory Authority
§ 18.2-40.15 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 39, Issue 14, eff. March 29, 2023.
11VAC20-20-220. Game set definition.
If the system has the capability to create a game set from a predefined set of criteria, the criteria must contain the following information:
1. Game identification;
2. Game set version;
3. Manufacturer;
4. Game name;
5. Paytable identification;
6. Purchase price per electronic pull-tab;
7. Subset size;
8. Total number of subsets; and
9. Prize values with an associated index and frequency.
Statutory Authority
§ 18.2-340.15 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 39, Issue 14, eff. March 29, 2023.
11VAC20-20-230. Data required to be available for each game set.
A. The following data shall be available prior to the opening of a game set for distribution and shall be maintained and be viewable both electronically and, if requested, by printed report, upon demand:
1. A unique serial number identifying each game set or subset;
2. A description of the game set sufficient to categorize the game set or subset relative to other game sets;
3. The total number of electronic pull-tabs in the game set;
4. The number of game subsets to be created from the game set and the number of electronic pull-tabs in each subset when applicable;
5. The payout percentage of the entire game set;
6. The purchase price per electronic pull-tab assigned to the game set; and
7. Prize values with an associated index and frequency.
B. The following data shall be available subsequent to the completion of a game set and shall be maintained and viewable both electronically and, if requested, by printed report, upon demand:
1. A unique serial number identifying each game set or subset;
2. Description of the game set sufficient to categorize the game set relative to other game sets;
3. The total number of electronic pull-tabs unsold;
4. The total number of electronic pull-tabs purchased;
5. The time and date that the game set or each game subset became available for play;
6. The time and date that the game set or each game subset was completed or removed from play;
7. Location where game set or subset was played;
8. The final payout percentage of the game set when removed from play; and
9. The purchase price per electronic pull-tab assigned to the game set.
C. In order to provide maximum game integrity, no audit or other determination of the status of any game set or any subset, including a determination of the prizes won or prizes remaining to be won, shall be conducted by anyone while a game set or subset is in play without causing termination of the entire game set or subset. Only upon game set termination shall the details of the associated game set and subsets be revealed to the individual performing the audit.
D. Once terminated, a game set shall not be able to be reopened.
Statutory Authority
§ 18.2-340.15 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 39, Issue 14, eff. March 29, 2023.
11VAC20-20-240. Security requirements.
A. A distributed pull-tab system computer must be in a locked, secure enclosure with key controls in place.
B. A distributed pull-tab system shall provide a means for terminating the game set if information about electronic pull-tabs in an open game set has been accessed or at the discretion of the department. In such cases, traceability of unauthorized access, including time and date, users involved, and any other relevant information shall be available.
C. A distributed pull-tab system shall not permit the alteration of any accounting or significant event information that was communicated from the electronic gaming device without supervised access controls. In the event financial data is changed, an automated audit log must be capable of being produced to document the following:
1. Data element altered;
2. Data element value prior to alteration;
3. Data element value after alteration;
4. Time and date of alteration; and
5. Personnel that performed alteration.
D. A distributed pull-tab system must provide password security or other secure means of ensuring data integrity and enforcing user permissions for all system components through the following means:
1. All programs and data files must only be accessible via the entry of a password that will be known only to authorized personnel;
2. The distributed pull-tab system must have multiple security access levels to control and restrict different classes;
3. The distributed pull-tab system access accounts must be unique when assigned to the authorized personnel and shared accounts amongst authorized personnel must not be allowed;
4. The storage of passwords and personal identification numbers must be in an encrypted, nonreversible form; and
5. A program or report must be available that will list all registered users on the distributed pull-tab system, including the registered user's privilege level.
E. All components of a distributed pull-tab system that allow access to users, other than end- users for game play, must have a password sign-on with two-level codes comprising the personal identification code and a personal password.
1. The personal identification code must have a length of at least six American Standard Code for Information Interchange (ASCII) characters; and
2. The personal password must have a minimum length of six alphanumeric characters, which should include at least one nonalphabetic character.
F. A distributed pull-tab system must have the capability to control potential data corruption that can be created by multiple simultaneous log-ons by system management personnel.
1. A distributed pull-tab system shall specify which of the access levels allow for multiple simultaneous sign-ons by different users and which of the access levels do not allow for multiple sign-ons, and if multiple sign-ons are possible, what restrictions, if any, exist; or
2. If a distributed pull-tab system does not provide adequate control, a comprehensive procedural control document must be drafted for the department's review and approval.
G. Distributed pull-tab system software components or modules shall be verifiable by a secure means at the system level. A distributed pull-tab system shall have the ability to allow for an independent integrity check of the components or modules from an outside source, and an independent integrity check is required for all control programs that may affect the integrity of the distributed pull-tab system. This must be accomplished by being authenticated by a third-party device, which may be embedded within the distributed pull-tab system software or having an interface or procedure for a third-party application to authenticate the component. This integrity check will provide a means for field verification of the distributed pull-tab system components.
H. A distributed pull-tab system may be used to configure and perform security checks on electronic gaming devices, provided such functions do not affect the security, integrity, or outcome of any game and meets the requirements set forth in this chapter regarding program storage devices.
Statutory Authority
§ 18.2-340.15 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 39, Issue 14, eff. March 29, 2023.
11VAC20-20-250. Backup and recovery.
A. A distributed pull-tab system computer shall have a separate physical medium for securely storing game sets or subsets on the computer, which shall be mirrored in real time by a backup medium.
B. All data required to be available or reported by this chapter must be retained for a period of not less than three years from the close of the fiscal year.
C. All storage of critical data shall utilize error checking and be stored on a nonvolatile physical medium.
D. The database shall be stored on redundant media so that no single failure of any portion of the system would result in the loss or corruption of data.
E. In the event of a catastrophic failure when the distributed pull-tab system cannot be restarted in any other way, it shall be possible to reload the distributed pull-tab system from the last viable backup point and fully recover the contents of that backup, to consist of at least the following information:
1. All significant events;
2. All accounting information;
3. Auditing information, including all open game sets and the summary of completed game sets; and
4. Employee files with access levels.
Statutory Authority
§ 18.2-340.15 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 39, Issue 14, eff. March 29, 2023.
11VAC20-20-260. Electronic accounting and reporting.
A. One or more electronic accounting systems shall be required to perform reporting and other functions in support of distributed pull-tab systems. The electronic accounting system shall not interfere with the outcome of any gaming function.
B. The following reporting capabilities must be provided by the electronic accounting system:
1. Electronic pull-tab game set report – game sets in play. An electronic pull-tab game set report must be available on demand for each game set currently in play. Game cards, outcomes, or prizes must not be revealed. The report must contain the following information:
a. A unique serial number identifying each game set or subset;
b. A description of the game set sufficient to categorize the game set or subset relative to other game sets;
c. The total number of electronic pull-tabs in the game set;
d. The number of game subsets to be created from the game set and the number of electronic pull-tabs in each subset when applicable;
e. The theoretical payout percentage of the entire game set;
f. The purchase price per electronic pull-tab assigned to the game set;
g. The time and date that the game set or each game subset became available for play; and
h. The location where the game set or subset is being played.
2. Electronic pull-tab game set report – completed game set. An electronic pull-tab game set report must be available on demand, for each completed game set. The report must contain the following information:
a. A unique serial number identifying each game set or subset;
b. Description of the game set sufficient to categorize the game set relative to other game sets;
c. The total number of electronic pull-tabs unsold;
d. The total number of electronic pull-tabs purchased;
e. The time and date that the game set or each game subset became available for play;
f. The time and date that the game set or each game subset was completed or removed from play;
g. The location where game set or subset was played;
h. The final payout percentage of the game set when removed from play; and
i. The purchase price per electronic pull-tab assigned to the game set.
3. A report that shall indicate all prizes that exceed the threshold that triggers additional procedures to be followed for the purpose of compliance with federal tax reporting requirements. At a minimum, on a daily and monthly basis, the report shall provide the following information per electronic gaming device:
a. The date and time won;
b. The location of prize award; and
c. The amount of each prize occurrence.
4. Liability report. A liability report shall provide a summary of the outstanding funds that carry from business day to business day. At a minimum, this report shall include:
a. Amount of prizes or vouchers that were awarded in dollars and cents, but have not yet been claimed that have not yet expired; and
b. Summary of all outstanding accounts.
C. A distributed pull-tab system shall be capable of providing an electronic file in a format specified by the department on a periodic basis to a location specified by the department. The data to be reported will contain, at a minimum, the following items per session:
1. Organization information;
2. Session date;
3. Total cash in;
4. Total cash out;
5. Total cash played;
6. Total cash won;
7. For all game sets on the system in play or in inventory:
a. Serial number;
b. Description;
c. Ticket price;
d. Number of subsets if applicable;
e. Number of tickets or number of tickets per subset;
f. Theoretical return percentage; and
g. Date game set was opened for play, when applicable; and
8. For all game sets completed or close since the previous reporting date:
a. Serial number;
b. Description;
c. Ticket price;
d. Number of subsets, if applicable;
e. Number of tickets or number of tickets per subset;
f. Theoretical return percentage;
g. Date game set was opened;
h. Date game set was closed;
i. Total tickets sold;
j. Total dollars in;
k. Total prizes paid; and
l. Actual return percentage.
Statutory Authority
§ 18.2-340.15 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 39, Issue 14, eff. March 29, 2023.
11VAC20-20-270. Randomization.
A. As used in this section, unless the context requires a different meaning:
"Card position" means the first card dealt, second card dealt in sequential order.
"Number position" means the first number drawn in sequential order.
B. A distributed pull-tab system shall utilize randomizing procedures in the creation of game sets for electronic pull-tabs or externally generated randomized game sets that have been created using a method previously approved by the department.
C. Any random number generation, shuffling, or randomization of outcomes used in connection with a distributed pull-tab system must be by use of a random number generation application that has successfully passed standard tests for randomness and unpredictability including:
1. Each card position or number position satisfies the 99% confidence limit using the standard chi-squared analysis. "Chi-squared analysis" is the sum of the ratio of the square difference between the expected result and the observed result to the expected result.
2. Each card position or number position does not produce a significant statistic with regard to producing patterns of occurrences. Each card position or number position will be considered random if it meets the 99% confidence level with regard to the "run test" or any similar pattern testing statistic. The "run test" is a mathematical statistic that determines the existence of recurring patterns within a set of data.
3. Each card position or number position is independently chosen without regard to any other card or number drawn within that game play. This test is the "correlation test." Each pair of card positions or number positions is considered random if it meets the 99% confidence level using standard correlation analysis.
4. Each card position or number position is independently chosen without reference to the same card position or number position in the previous game. This test is the "serial correlation test." Each card position or number position is considered random if it meets the 99% confidence level using standard serial correlation analysis.
Statutory Authority
§ 18.2-340.15 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 39, Issue 14, eff. March 29, 2023.
11VAC20-20-280. Communications and network requirements.
A. Where the distributed pull-tab system components are linked with one another in a network, communication protocols shall be used that ensure that erroneous data or signals will not adversely affect the operations of any such system components.
B. All data communication shall incorporate an error detection and correction scheme to ensure the data is transmitted and received accurately.
C. Connections between all components of the distributed pull-tab system shall only be through the use of secure communication protocols that are designed to prevent unauthorized access or tampering, employing Advanced Encryption Standard (AES) or equivalent encryption.
D. A firewall or equivalent hardware device configured to block all inbound and outbound traffic that has not been expressly permitted and is not required for continued use of the distributed pull-tab system must exist between the distributed pull-tab system and any external point of access.
E. The minimum width (size) for encryption keys is 112 bits for symmetric algorithms and 1024 bits for public keys.
F. There must be a secure method implemented for changing the current encryption key set. It is not acceptable to only use the current key set to "encrypt" the next set.
G. There must be a secure method in place for the storage of any encryption keys. Encryption keys must not be stored without being encrypted themselves.
H. If a wireless network is used, wireless products used in conjunction with any gaming system or system component must meet the following minimum standards:
1. Employ a security process that complies with the Federal Information Processing Standard 140-2 (FIPS 140-2); or
2. Employ an alternative method, as approved by the department.
Statutory Authority
§ 18.2-340.15 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 39, Issue 14, eff. March 29, 2023.
11VAC20-20-290. Significant events.
The following significant events, if applicable, shall be collected from the electronic gaming device or point of sale and communicated to the system for storage and a report of the occurrence of the significant event must be made available upon request:
1. Power resets or power failure.
2. Communication loss between an electronic gaming device and any component of the distributed pull-tab system.
3. Electronic gaming device jackpot (any award in excess of the single win limit of the electronic gaming device).
4. Door openings (any external door that accesses a critical area of the electronic gaming device).
5. Bill validator errors:
a. Stacker full (if supported); and
b. Bill jam.
6. Printer errors:
a. Printer empty; and
b. Printer disconnect or failure.
7. Corruption of the electronic gaming device RAM or program storage device.
8. Any other significant events as defined by the protocol employed by the distributed pull-tab system.
Statutory Authority
§ 18.2-340.15 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 39, Issue 14, eff. March 29, 2023.
11VAC20-20-300. Validation system and redemption.
A distributed pull-tab system may utilize a voucher validation system to facilitate gaming transactions. The validation system may be entirely integrated into a distributed pull-tab system or exist as a separate entity.
1. A distributed pull-tab system may allow voucher out only; vouchers shall not be inserted, scanned, or used in any way at the electronic gaming device for redemption.
2. The validation system must process voucher redemption correctly according to the secure communication protocol implemented.
3. The algorithm or method used by the validation system or distributed pull-tab system to generate the voucher validation numbers must guarantee an insignificant percentage of repetitive validation numbers.
4. The validation system must retrieve the voucher information correctly based on the secure communication protocol implemented and store the voucher information in a database. The voucher record on the host system must contain, at a minimum, the following voucher information:
a. Validation number;
b. Date and time the electronic gaming device printed the voucher;
c. Value of voucher in dollars and cents;
d. Status of voucher;
e. Date and time the voucher will expire;
f. Serial number of electronic gaming device; and
g. Location name or site identifier.
5. The validation system or distributed pull-tab system must have the ability to identify the following occurrences and notify the cashier when the following conditions exist:
a. Voucher cannot be found on file;
b. Voucher has already been paid; or
c. Amount of the voucher differs from the amount on file (requirement may be met by display of voucher amount for confirmation by cashier during the redemption process).
6. If the connection between the validation system and the distributed pull-tab system fails, an alternate method or procedure of payment must be available and shall include the ability to identify duplicate vouchers and prevent fraud by redeeming vouchers that were previously issued by the electronic gaming device.
7. The following reports related to vouchers shall be generated on demand:
a. Voucher Issuance Report shall be available from the validation system that shows all vouchers generated by an electronic gaming device; and
b. Voucher Redemption Report shall detail individual vouchers and the sum of the vouchers paid by the validation terminal or point of sale by session and shall include the following information:
(1) The date and time of the transaction;
(2) The dollar value of the transaction;
(3) The validation number;
(4) A transaction number; and
(5) The point-of-sale identification number or name.
8. The validation system database must be encrypted and password protected and should possess an unalterable user audit trail to prevent unauthorized access.
9. The normal operation of any device that holds voucher information shall not have any options or method that may compromise voucher information. Any device that holds voucher information in its memory shall not allow removal of the information unless it has first transferred that information to the ticketing database or other secured component of the validation system.
Statutory Authority
§ 18.2-340.15 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 39, Issue 14, eff. March 29, 2023.
11VAC20-20-310. Point of sale; validation terminal.
A. A distributed pull-tab system may utilize a point-of-sale or validation terminal that is capable of facilitating the sale of the organization's pull tab outcomes or used for the redemption of credits from player accounts or vouchers. The point of sale may be entirely integrated into a distributed pull-tab system or exist as a separate entity.
B. Point-of-sale use is only permissible when the device is linked to an approved validation system or distributed pull-tab system.
C. If a distributed pull-tab system utilizes a point of sale, it shall be capable of printing a receipt for each sale, void, or redemption. The receipt shall contain the following information:
1. Date and time of the transaction;
2. Dollar value of the transaction;
3. Validation number, if applicable;
4. Quantity of associated products, if applicable;
5. Transaction number;
6. Account number, if applicable; and
7. Point-of-sale identification number or name.
D. The following point-of-sale or validation terminal reports shall be generated on demand:
1. Sales transaction history report shall show all sales and voids by session and include the following information:
a. Date and time of the transaction;
b. Dollar value of the transaction;
c. Quantity of associated products;
d. Transaction number; and
e. Point of sale identification number or name.
2. Voucher redemption report shall detail individual voucher redemptions paid by the validation terminal or point of sale by session and include the following information:
a. Date and time of the transaction;
b. Dollar value of the transaction;
c. Validation number;
d. Transaction number; and
e. Point of sale identification number or name.
Statutory Authority
§ 18.2-340.15 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 39, Issue 14, eff. March 29, 2023.
11VAC20-20-320. Location of equipment.
All equipment used to facilitate the distribution, play, or redemption of electronic games must be physically located within the boundaries of the Commonwealth of Virginia. This includes the distributed pull-tab system, electronic gaming devices, redemption terminals, and point-of-sale stations.
Statutory Authority
§ 18.2-340.15 of the Code of Virginia.
Historical Notes
Derived from Virginia Register Volume 39, Issue 14, eff. March 29, 2023.